diff options
| author | 2023-10-19 09:49:31 -0700 | |
|---|---|---|
| committer | 2023-10-19 09:56:52 -0700 | |
| commit | 35a397c495f86f8a59248ff11ce6d71a9a749fcb (patch) | |
| tree | 58ac3f339ae292e088e284fb667fecb58efc8257 /libs/androidfw/ZipFileRO.cpp | |
| parent | 6b30dd666d4b215ee49af09ff37c7428f1a05e16 (diff) | |
StrictMode: fix race condition in onVmPolicyViolation
There's a TOCTOU race condition in onVmPolicyViolation() that can cause
a NullPointerException if multiple threads trigger a violation and a
penalty listener is set. For example:
1. Thread 1 passes the mCallbackExecutor null check and calls execute()
2. T2 passes the same check and then gets preempted
3. Runnable queued by T1 temporarily replaces sVmPolicy with LAX (which
has a null executor) by calling allowVmViolations()
4. T2 calls execute() on sVmPolicy.mCallbackExecutor, which is now null
Fix it by using the same VmPolicy object throughout onVmPolicyViolation.
Test: atest StrictModeTest
Change-Id: Ifa20253ea936b8d3d8c3719c3278bfaccbdf8275
Diffstat (limited to 'libs/androidfw/ZipFileRO.cpp')
0 files changed, 0 insertions, 0 deletions